A federal watchdog has concluded that the Transportation Security Administration didn’t adequately control how a contractor could reach passenger identity images. The Department of Homeland Security’s Office of Inspector General published an unclassified summary of an audit of TSA’s facial recognition and identification technologies. The detailed findings are classified, but the summary says the audit uncovered a “significant weakness” in the technology’s ability to protect passenger data privacy.[1]
The wording matters here. The audit didn’t report a confirmed breach or a mass leak of faces. It described a gap in oversight that created risk. Below is what the reporting says, what it doesn’t say, and why it matters as facial comparison spreads across American airports.
What the Inspector General Actually Found
The audit set out to judge whether TSA’s technologies help identify persons of interest and authenticate traveler information while protecting privacy. The OIG’s stated aim was to determine how far those tools enhance screening “while protecting passenger privacy.”[2] The privacy problem centered on a specific piece of equipment, not on the entire checkpoint process.
That equipment is Credential Authentication Technology 2, usually shortened to CAT-2. The OIG found that the CAT-2 vendor was able to access and extract sensitive passenger information, including driver’s license and passport images, during system troubleshooting and enhancements, without TSA’s knowledge.[3] In plain terms, the agency running the checkpoints didn’t have full visibility into what its contractor could pull from the machines.
How CAT-2 Works at the Checkpoint
If you’ve flown recently, you’ve probably used one. CAT-2 machines scan and authenticate a traveler’s identity document, retrieve flight and prescreening information, and use a camera to compare a live photograph with the photo on the credential.[4] The officer then sees the result and makes a decision.
The design is meant to limit what’s kept. Staff of the Privacy and Civil Liberties Oversight Board described the routine one-to-one system as a “nearly ideal case of data protection,” since the images typically stay on the device only for the seconds needed for the comparison.[4] That context is important, because the audit’s concern wasn’t the routine flow. It was what can happen outside it.
The Vendor Oversight Gap
The inspector general’s criticism was fairly specific. TSA lacked clear policies, didn’t track when the data was extracted, couldn’t verify that extracted information was properly deleted, and didn’t notify passengers when their biometric and biographic information might have been stored.[3] Those are four distinct management failures, and they stack on top of each other.
The OIG framed the consequence carefully. Passenger information was generally protected during routine operations, but weak vendor oversight created a risk that sensitive personal information could be retained or exposed.[3] A risk isn’t an incident, yet an agency that can’t track extractions also can’t say with confidence that nothing went wrong. Commentary on the report has pointed to Idemia Identity and Security USA among the contractors, and a 2023 TSA announcement said the agency awarded $128 million to contractors to develop CAT-2.[2]
What TSA Did Right, According to the Audit
The report wasn’t uniformly negative. The audit determined that TSA personnel delete photos of passengers moving through airport checkpoints in a timely fashion and in accordance with federal regulations.[2] That supports TSA’s long-standing public claim that routine scans aren’t stored.
Still, good habits at the front line don’t settle the question of back-end access. A checkpoint can delete images on schedule while a vendor’s maintenance work creates copies elsewhere. The audit’s point was that nobody at TSA could confirm either way.
Recommendations and TSA’s Response
For the vendor-access issue, the OIG offered a short list of fixes. It issued one finding and three recommendations to strengthen controls, improve oversight, and ensure transparency and proper handling of passenger data. TSA concurred with all three, though two are open and resolved and one remains open and unresolved.[3]
A separate part of the broader work involved covert testing of how well checkpoint technology and officers catch fraudulent IDs. That portion produced three findings and six recommendations, with TSA agreeing to five and rejecting one.[5] Since the full details are classified, outsiders can’t judge how serious those testing results were.
A Fast-Growing Program Raises the Stakes
Scale is what turns a vendor-oversight lapse into a national concern. A 2025 PCLOB staff report said TSA had deployed more than 2,100 facial recognition-enabled CAT-2 machines at more than 250 airports as of April 2025.[4] TSA ultimately intends to use the technology across more than 400 airports where the federal government conducts passenger screening.[4]
The rollout may speed up. TSA’s fiscal year 2027 budget request seeks $41 million for CAT procurement and deployment, which the agency says would move full operational capability from fiscal year 2042 to 2029.[4] More machines mean more maintenance, more vendor access, and more reasons to get the oversight rules right early.
A Second Audit Flags Account Control Problems
The CAT-2 report didn’t arrive alone. A September 30 inspector general audit found that TSA improperly managed privileged computer accounts, created service accounts without required approvals, and failed to consistently disable accounts for employees who had left.[5] That audit concerned TSA’s network security more broadly, not facial scans specifically.
The inspector general’s warning was blunt. The vulnerabilities could allow an attacker to compromise TSA’s network, access sensitive information without authorization, and cause serious or even catastrophic damage to agency operations.[5] Taken together, the two audits suggest that access governance, whether for contractors or employees, is the recurring weak spot.
Opting Out and What Comes Next
Travelers do have a choice at the checkpoint. TSA’s own website says passengers who decline to have their photo taken for facial comparison can do so without delay or disruption.[6] An officer then checks the ID manually. Privacy advocates such as the Electronic Frontier Foundation have used the audit to remind people of that option.
The bigger test is whether TSA closes the open recommendations and can show it tracks every vendor extraction and deletion. The audit found that routine checkpoint use was generally protected, yet it also showed that the agency couldn’t verify what happened behind the scenes. As facial comparison becomes standard, that gap between what’s promised and what can be proven is the thing to watch.
